VirTool:Win32/Obfuscator.QV

user@threatcheck.sh ~ threat-analysis

bash

$ analyze-threat VirTool:Win32/Obfuscator.QV

VirTool:Win32/Obfuscator.QV - Windows Defender threat signature analysis

$ cat analysis.txt

=== THREAT ANALYSIS REPORT ===

Threat Name: VirTool:Win32/Obfuscator.QV

Classification:

Type:VirTool

Platform:Win32

Family:Obfuscator

Detection Type:Concrete

Known malware family with identified signatures

Variant:QV

Specific signature variant within the malware family

Confidence:Very High

False-Positive Risk:Low

Concrete signature match: Virus Tool - Tool used to create or modify malware for 32-bit Windows platform, family Obfuscator

Summary:

VirTool:Win32/Obfuscator.QV is a concrete detection for an obfuscation tool designed to evade security and facilitate malicious activity. It abuses legitimate Windows utilities like mshta, regsvr32, rundll32, and PowerShell, while employing hooking, persistence via scheduled tasks, and remote file copying to hide and enable broader compromise.

Severity:

Critical

VDM Static Detection:

Relevant strings associated with this threat:
 - hfre32.qyy (PEHSTR_EXT)
 - jf2_32.qyy (PEHSTR_EXT)
 - jvavarg.qyy (PEHSTR_EXT)
 - nqincv32.qyy (PEHSTR_EXT)
 - furyy32.qyy (PEHSTR_EXT)
 - agqyy.qyy (PEHSTR_EXT)
 - !#HSTR:StringCodeForMshta.A!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForHooking.C!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForHooking.D!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForHooking.L!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForHooking.O!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForRegsvr32.A!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForRundll32.A!pli (PEHSTR_EXT)
 - rundll32 (PEHSTR_EXT)
 - !#HSTR:StringCodeForBITSJobs.A!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForPowerShell.G!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForScheduledTask.A!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForDataEncoding.D!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForHooking.J!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForHooking.K!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForRemoteFileCopy.B!pli (PEHSTR_EXT)
 - !#HSTR:ExecutionGuardrails (PEHSTR_EXT)
 - !#HSTR:StringCodeForFileDeletion.A!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForHooking.M!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForNetshHelperDLL.A!pli (PEHSTR_EXT)
 - !#HSTR:StringCodeForRemoteServices.A!pli (PEHSTR_EXT)

YARA Rule:

rule VirTool_Win32_Obfuscator_QV_2147716824_0
{
    meta:
        author = "threatcheck.sh"
        detection_name = "VirTool:Win32/Obfuscator.QV"
        threat_id = "2147716824"
        type = "VirTool"
        platform = "Win32: Windows 32-bit platform"
        family = "Obfuscator"
        severity = "Critical"
        signature_type = "SIGNATURE_TYPE_PEHSTR_EXT"
        threshold = "23"
        strings_accuracy = "High"
    strings:
        $x_10_1 = {eb 09 0f be c9 c1 c0 07 33 c1 42 8a 0a 84 c9 75 f1}  //weight: 10, accuracy: High
        $x_10_2 = {8a 01 3c 61 7c 15 3c 7a 7f 11 0f be c0 83 e8 54 6a 1a 99 5f f7 ff 80 c2 61 eb 17 3c 41 7c 15 3c 5a 7f 11 0f be c0 83 e8 34 6a 1a 99 5f f7 ff 80 c2 41 88 11 41 80 39 00 75 c6}  //weight: 10, accuracy: High
        $x_1_3 = "hfre32.qyy" ascii //weight: 1
        $x_1_4 = "jf2_32.qyy" ascii //weight: 1
        $x_1_5 = "jvavarg.qyy" ascii //weight: 1
        $x_1_6 = "nqincv32.qyy" ascii //weight: 1
        $x_1_7 = "furyy32.qyy" ascii //weight: 1
        $x_1_8 = "agqyy.qyy" ascii //weight: 1
    condition:
        (filesize < 20MB) and
        (
            ((2 of ($x_10_*) and 3 of ($x_1_*))) or
            (all of ($x*))
        )
}

Known malware which is associated with this threat:

Filename: B0B80593525CEC7F838273B1FDDA6A52.exe

081c556f0ef5c8e0559ba435a0996a1cb74409fc72a01feeded8dc60bf257b50

13/01/2026

→VirusTotal ↓Download Sample

Filename: 8.exe

87b27ec9a27fccb63c23688277e50ed0d1afc598d981a6169ed4b14a21188452

12/01/2026

→VirusTotal ↓Download Sample

Filename: 6.exe

16711abff41ad69c4e2eaec323fe4037dddb072d6028628dee85d2c37ac5ab94

11/01/2026

→VirusTotal ↓Download Sample

Filename: 4.exe

95b9cfba9339553903e7bec515a05851b75bb601b06169cb5d11b1f1b8005d84

09/01/2026

→VirusTotal ↓Download Sample

Filename: 7144bfd369c6070f8723bb8523cd9246.exe

fd1ce709645e820d6347b03a688cc2a5c1b4fd79c3138ddcc66d3da50e654030

06/01/2026

→VirusTotal ↓Download Sample

Remediation Steps:

Immediately isolate the infected system. Conduct a full antivirus scan, remove all detected artifacts, and analyze system logs for persistence mechanisms or further compromise. Consider re-imaging the system to ensure complete eradication.

=== END REPORT ===

$ reanalyze-threat

This analysis was last updated on 23/12/2025. Do you want to analyze it again?

$ ls available-commands/

→ cd /home

user@threatcheck.sh:~$ ▊

VirTool:Win32/Obfuscator.QV - Windows Defender Threat Analysis